Once ipset and its necessary supporting packages are installed, we need to tell CSF that ipset is available and ready to be used. Core packages are considered part of the AL2023 major version and receive 5 years of long-term support.

A subset of packages in AL2023 are designated as core packages. Or for an apt based Linux distro like Ubuntu or Debian, run: The following list includes all packages for Amazon Linux 2023 release AL2023. CentOS, Red Hat and Fedora (yum) users do this by: To get started, we want to install ipset. These IP sets are stored in a fast and efficient manor that allows for quick access and searching, plus seamless updates to the IP sets without having to reload iptables. IP sets are a framework inside the Linux kernel that can store IP addresses, networks, TCP/UDP port numbers, MAC addresses - or combinations of some/all of the prior.

Thankfully, it is possible to quickly and easily alleviate this slowdown by installing and configuring a took called ipset. Servers running iptables with CSF firewall can become slow and bogged down while processing the sometimes hundreds of IP addresses in CSF's iptables chains.

Improve CSF iptables performance with ipset

Ipset linux